Privacy Policy
Last updated 25 September 2026
This policy covers the Shopify apps made by Quiet Penguin and this website. It's written to be read: it says exactly what we hold, why, and when it's gone.
Who we are
Quiet Penguin is Stephen Bedford, a sole trader based in Ireland, trading as Quiet Penguin. For anything about your data, email support@quietpenguin.com.
For information about your own store and account, we are the data controller. For the details of your store's orders, we process them on your behalf, as you instruct by installing the app; you remain the controller of your customers' data.
Missing Orders for Starshipit
Missing Orders checks that paid Shopify orders reach Starshipit, and emails you when one hasn't. To do that, it holds only the following.
About your store
- Your store's Shopify address (e.g. example.myshopify.com) and time zone.
- An access token from Shopify that lets the app read your orders.
- Your Starshipit API keys, encrypted. They're used only to look up whether orders have arrived in Starshipit.
- The email address you choose for alerts.
- Your settings: grace period, which locations Starshipit imports from, excluded delivery methods, ignored tags and whether the weekly email is on.
- When the app was installed, last checked and last emailed you.
About your orders
- Shopify's id for the order, and its order number (e.g. #1005).
- When it was paid.
- Yes/no facts the checks need: paid, cancelled, refunded, fulfilled, needs shipping, has a shipping address. Also its delivery method, location and tags.
- Whether it reached Starshipit, and when we checked and emailed you about it.
What it never holds
The app never requests or stores your customers' names, email addresses, phone numbers or addresses. For shipping, it asks Shopify only whether an order has an address, not what the address is. When it looks up an order in Starshipit, the reply can contain customer details; the app uses only whether the order is there and discards the rest, without storing or logging it. It stores nothing about your staff either.
Your subscription is billed by Shopify. We never see your payment details.
Why
Only to provide the service you installed: checking orders, emailing you alerts and the weekly all-clear, and billing through Shopify. The legal basis is our contract with you. We don't sell data, use it for advertising, or combine it with anything else.
Who processes it for us
| Provider | What for | Where |
|---|---|---|
| Shopify | The platform the app runs on, and billing | Ireland and elsewhere |
| Railway | Hosting the app and its database | United States |
| Resend | Sending alert and weekly emails | Ireland (sending), United States (company) |
| Cloudflare | This website, and forwarding support email | Worldwide network |
Where data is transferred outside the European Economic Area, it's protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, under each provider's data processing terms.
Starshipit isn't on this list because it's your provider, not ours: the app reads from your Starshipit account with the keys you give it.
How long we keep it
- While the app is installed, for as long as it's needed to check your orders.
- When you uninstall, the app stops checking and your Starshipit keys are deleted straight away.
- 48 hours after you uninstall, Shopify asks us to delete your store's data, and we delete everything we hold for it.
- When a customer asks your store to delete their data, Shopify tells us and we delete our records of that customer's orders.
- Our server logs record requests and check results (e.g. your store's address and order numbers, never customer details) and are kept by Railway for a limited period.
Security
The app talks to Shopify, Starshipit and Resend only over encrypted connections, and its database sits on Railway's private network. Starshipit keys are encrypted (AES-256-GCM) before they're stored, and are never written to logs.
This website
This site sets no cookies and runs no analytics or tracking. Cloudflare, which serves it, processes visitors' IP addresses to deliver pages and protect against attacks. If you email us, we keep your message to answer it.
Your rights
You can ask us for a copy of the data we hold about you, to correct it, to delete it, or to restrict or object to how we use it. Email support@quietpenguin.com and we'll answer within a month. If your customers ask you about their data, we'll help you answer them.
If you're unhappy with how we handle your data, you can complain to Ireland's Data Protection Commission or to the data protection authority where you live.
Changes
If we change this policy, we'll update the date at the top, and tell you by email first if the change affects how we use your data.